Records of Processing Activities
The records of processing activities (RoPA) are the central inventory of all personal data processing. They are the basis for almost every following workshop, so this one deserves particular care.
Workshop 3 video
Walkthrough of the workshop and its tasks — coming soon
What ResGuard provides
- Records of processing (RoPA) module with a library of ready-made processing activities
- Training slides with an explanation and a practical example for every task
- Built-in fields for data, data subjects, purpose, legal basis, retention and recipients, so nothing is forgotten
- Links to departments, applications and vendors, and an Excel export for auditors
Workshop tasks
-
1. Identify processing activities
Run short interviews with each department: HR (recruitment, payroll, attendance), sales and marketing (clients, newsletters, website), finance (invoicing, collections) and IT (accounts, email, video surveillance).
In ResGuard: Data InventoryPresentation: open the slides for this task -
2. Data, data subjects & flows
For each activity, document the data categories, whether sensitive data is involved, the data subjects, the source, the recipients and the systems. Remove data that is not needed.
In ResGuard: Data InventoryPresentation: open the slides for this task -
3. Purpose & legal basis
Describe a concrete purpose and assign the matching legal basis: consent, contract, legal obligation or another exception provided by law.
In ResGuard: Data InventoryPresentation: open the slides for this task -
4. Consent management
Where processing relies on consent, document how it is obtained, how it is recorded so it can be proven, and how it can be withdrawn.
Presentation: open the slides for this task -
5. Retention & transfers
Record the retention period and transfers to other countries or within the group. They are the basis for workshops 6 and 10.
In ResGuard: Data InventoryPresentation: open the slides for this task -
6. Review & maintenance
Assign an owner to each activity, define an annual review and the triggers for updates: new systems, purposes or vendors.
Presentation: open the slides for this task -
7. Workshop review & close-out
Review the complete RoPA with the DPO, attach evidence and close the objective in ResGuard.
In ResGuard: Objective ManagerPresentation: open the slides for this task
What to keep in mind in Peru
- In Peru, personal databases are registered with the National Register for Personal Data Protection. Use the RoPA to identify which databases you need to register or update.
- Consent must be free, prior, express, informed and unequivocal. For sensitive data the law also requires it to be in writing.
- Document cross-border data flows; they are reviewed in detail in Workshop 10.
Expected result
- Processing activities from all departments recorded in the RoPA
- Data, data subjects, purpose and legal basis documented per activity
- Retention periods and transfers recorded
- Owners and review cycle assigned
ResGuard modules: Data Inventory (RoPA)